Who's Tracking When You're Browsing?

Online privacy was in the headlines recently when news broke that Google bypassed privacy settings in Apple's Safari browser and Microsoft's Internet Explorer browser to install cookies to track activity. The stories stirred up concerns among users about what information is being collected about them.

Let's first review what a cookie is and what it does. Cookies are small files that websites can place on a hard drive to do things like identify returning visitors, personalize content displayed, and store items in shopping carts. They are also used for data collection to determine usage statistics.

Jumping Through a Loophole in Safari
Researchers discovered that Google bypassed the privacy settings in Safari by exploiting a loophole. It involved tricking the Safari browser into allowing it to install cookies to serve ads with a tie-in to its Google Plus social network — adding a +1 button to ads for users to click if they approved of them. Because of another quirk in Safari, this opened the door for additional Google cookies to be installed, potentially allowing wider tracking.

Google's response was that it used known Safari functionality to provide features for people who were signed into Google services. Enabling the installation of additional cookies was unintentional, it said, so the company started removing these cookies from Safari browsers. Google also noted that the cookies do not collect personal information.

Exploring What Happened With Internet Explorer
Shortly after the Safari loophole was announced, Microsoft discovered that the privacy preferences of Internet Explorer's users were also being circumvented by Google. Microsoft said Google was getting around a privacy safeguard in its Internet Explorer 9 browser that helps users prevent advertisers from placing cookies on their computers.

Here's how it happened: IE9 blocks sites from installing cookies for other sites so Google.com shouldn't be able to install a cookie for its advertising arm, DoubleClick.com. The exception is that IE9 does allow sites to install third-party cookies if they flash a kind of "digital ID card" called P3P (Platform for Privacy Preferences). P3P relies on sites like Google to volunteer a description of themselves, including what will be done with data gleaned from tracking users. Any site that refuses to describe itself to Microsoft's browser gets a tracking cookie anyway. In other words, the system only blocks sites that explicitly identify themselves as advertisers. Those that don't identify themselves at all can slip through.

Take Action to Guard Your Privacy
What steps can you take if you're concerned about browser tracking? Web browsers have settings that allow you to manage at least some tracking activity by setting your cookie preferences, and you can also choose to delete certain cookies. Simply follow the tutorials included here.